Week 17, 2024
22 April to 28 April 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 574CVEs publishedin the whole week
- 55CriticalCVSS 9.0 and above
- 194HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-20353
A vulnerability in the management and VPN web servers for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedHigh8.6 - CVE-2024-20359
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plug-ins and that has been available in Cisco Adaptive Security…
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedMedium6.0 - CVE-2022-38028
Windows Print Spooler Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2024-32651
Server Side Template Injection in Jinja2 allows Remote Command Execution
dgtlmoon · changedetection.io
Critical10.0 - CVE-2024-32766
QTS, QuTS hero, QuTScloud
QNAP Systems Inc. · QTS
Critical10.0 - CVE-2024-0916
Unauthenticated Remote Code Execution in UvDesk Community
Webkul Software · UvDesk Community
Critical10.0 - CVE-2023-31090
WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability
Unlimited Elements · Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Critical9.9 - CVE-2023-51482
WordPress Eazy Plugin Manager plugin <= 4.1.2 - Auth. Arbitrary Options Update lead to RCE vulnerability
EazyPlugins · Eazy Plugin Manager
Critical9.9 - CVE-2024-3342
Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection
jetmonsters · Timetable and Event Schedule by MotoPress
Critical9.9 - CVE-2024-32764
myQNAPcloud Link
QNAP Systems Inc. · myQNAPcloud Link
Critical9.9 - CVE-2024-4040
Unauthenticated arbitrary file read and remote code execution in CrushFTP
CrushFTP · CrushFTP
ExploitedCritical9.8 - CVE-2024-27348
Apache HugeGraph-Server: Command execution in gremlin
Apache Software Foundation · Apache HugeGraph-Server
ExploitedCritical9.8 - CVE-2024-32238
H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login…
Product not named
Critical9.8